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Abrica™ Security Framework 



Overview 




Abrica™ 



Abrica may be implemented using any technology that allows trading partners and 
channel partners to communicate with one another and with the Abrica service in 
electronic form. For example, the different entities may communicate using direct or 
indirect connections, e-mail, the Internet, a WAN or another rype of communication 
network* 

In the present example (shown above), the communication mechanism is deployed as 
an Tntemet-wide service. Trading partners who subscribe to the Abrica service will 
use the same core service for sending/receiving transmissions. Abrica will serve as 
the ''forwarder" of transmissions. Each trading partner will post its transmission to 
the Abrica service where non-repudiation audit trail will be created. From mere, die 
service will forward the transmission to the destination trading partner using email as 
the conveyance mechanism. 
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The unique security infrastructure of the Abrica client and server software allows 
strong encryption and lEMevd authentication to be accomplished in a single 
transmission "round trip" (HTTPS post & status Teply). The processes employ 
cryptographic techniques well-suited to online transaction processing (OLTP) 
environments supporting large traffic volumes while foregoing the significant 
overhead and management hurdles associated with systems based purely on public 
key infrastructure (PKI) technologies. 



Key Management 

Abrica's key management is illustrated by the graphic below. The Abrica service has 
an SSL certificate rooted with a recognized certificate authority (CA). Each Abrica 
subscriber has a copy of the service's public PKI key* plus a unique identifying key 
(TO key), which was assigned to it by the Abrica service ar the time the subscriber 
joined the network. The Abrica service maintains a copy of each subscriber's DO key 
along with its own public and private PKI keys. 
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Abrica Service 



Tm> Abrica senrfca rtastoPKi. 
private key (Ifghipurpta) and 
puWto key (dark purpio) in a 
beat secure data store. Trie 
ADrtca service maintain* a copy 
or eacft aubscn&er's *Td* koy in 
trsMoure aataoase (orange 
toy, bim icey. eic). 




Receiver 



The recBJver(B(aa Oa.) nan 
mew private ID" key (blue Key) 
bm Abrtca sofvloa's PKI public 
toy (dark purpte key) in a 
aacura local daia score. 




Outbound Transmission to Service 

An outbound transmission "payload" is created. It is expected Thai this pay load, 
which may contain multiple electronic files of various types, will include an 
indicator that can be used to identify the intended recipient of the transmission. 

As a first step, a unique session key is created tor each outbound transmission. This 
session key is asymmetric key 91 of appropriate cryptographic strength (e.g. 128 bit)- 
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Receiver 




As a second step, and in order to authenticate the originator of the transmission, the 
sender will encrypt a copy of the session key using his unique ID key. This 
encrypted session key will be included in the transmission pay load. 
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All Abrica transmissions arc sent in an encrypted form. The session key is used xo 
encrypt the transmission payload. Optionally, and to reduce the size of the 
transmission payload, compression technologies such as ZIP may be employed. 
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In order to insure that the payload cannot be surreptitiously intercepted (the ''man in 
the middle" attack), the session key is encrypted using the Abrica service's public 
PTCT key. In this way, no entity save the owner of the corresponding PK1 private key 
will be able to obtain die session key needed to decrypt die payload. 
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Abrtca Service 




Receiver 




The entire transmission, including the payload, the ID-encrypted session key, and the 
PKl-encrypted session key, is securely sent to die Abrica service. In the present 
example, it is posted using HTTPS via a secure socket layer (SSL). 
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Ttie 6rtU^e package Is posted to 
the Abrica service using 
HTTPS. The senctof keeps a 
copy of ine session key for later 
processing of the HTTPS 
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Receiver 




Processing Inside Service 



Inbound transmissions received by the Africa service are processed using a 
combination of the Abrica PKJ private key and the sender's ED key. In this way, die 
Abrica service proves itself as die intended recipient (as the sole owner of The 
necessary private key) and authenticates the purported sender as die true sender (the 
owner of the corresponding TD key). 
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After completing internal processing, such as laying down non-repudiation audit trail 
regarding the sender, the intended receiver, and the payload contents, the Abrica 
service prepares the transmission for forwarding to the intended recipient This is 
done using the Abrica service's private key and the intended recipient's ID key. 

The use of these keys authenticates the Abrica service as the forwarder (again, 
thwarting a w man in the middle" attack) and insures that only the intended recipient 
will he able to obtain the session key needed to decrypt the payload. 
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Transmission from Service to Recipient 

After processing, the transmission is securely forwarded by the Abrica service to the 
intended recipient. In the present example, the transmission is sent by simple mail 
transport protocol (SMTP), essentially arriving in the recipient's email inbox as an 
email with an encrypted attachment Optionally, and to reduce the size of the 
transmission, the payload and the necessary keys may be compressed using ZIP or 
other appropriate technologies. 




Status Reply from Service to Sender 

Feedback is provided by the Abrica service to the sender. This feedback provides 
explicit evidence to the sender mat the transmission has been successfully processed 
and authenticates to the sender that the Abrica service was the recipient of the 
forwarded transmission. 

In the present example, the feedback is provided by the HTTPS return code, which is 
sent in reply to the original posting. The Abrica services uses its privato FK1 key to 
authenticate itself, and me session key to encrypt the transmission. 
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.ZIP 4 




The sender of the transmission receives feedback from the Abrica service, which in 
the present example is an HTTPS reply. The sender employs the original sess ion key 
to decrypt the transmission contents and uses the Abrica service's PK1 pubhc key to 
authenticate that the feedback has in fact come from the Abrica service (defeating 
any attempt at a "man in the middle" attack). 
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Processing by Recipient 



The intended recipient receives the sender's original transmission pay load via a 
secure transport mechanism. In the present example, the transmission was received 
as an encrypted attachment to an email message. 

The recipiont employs Its TD key to decrypt the session key, which can then be used 
by the recipient to decrypt the sender's original pay load. The use of the ID key 
insures that the Intended recipient is the only one who could decrypt the session key 
(and hence gain access to the encrypted payload). The recipient also employs the 
Abrica service's public key to authenticate that the transmission has in feet been 
forwarded to it by the Abrica service. This latter authentication defeats a potential 
•man in the middle** attack. 
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